SONAR-8716 fix check of permissions in api/settings

* api/settings/list
* api/settings/values

server/sonar-server/src/main/java/org/sonar/server/property/ws/IndexAction.java

@@ -49,8 +49,8 @@ import org.sonar.server.ws.WsAction;
 import static org.apache.commons.lang.StringUtils.isEmpty;
 import static org.sonar.api.PropertyType.PROPERTY_SET;
 import static org.sonar.api.web.UserRole.ADMIN;
-import static org.sonar.server.setting.ws.SettingsPermissionPredicates.DOT_LICENSE;
-import static org.sonar.server.setting.ws.SettingsPermissionPredicates.DOT_SECURED;
+import static org.sonar.server.setting.ws.SettingsWsSupport.DOT_LICENSE;
+import static org.sonar.server.setting.ws.SettingsWsSupport.DOT_SECURED;
 import static org.sonar.server.ws.KeyExamples.KEY_PROJECT_EXAMPLE_001;
 
 public class IndexAction implements WsAction {

server/sonar-server/src/main/java/org/sonar/server/setting/ws/ListDefinitionsAction.java

@@ -50,15 +50,15 @@ public class ListDefinitionsAction implements SettingsWsAction {
   private final ComponentFinder componentFinder;
   private final UserSession userSession;
   private final PropertyDefinitions propertyDefinitions;
-  private final SettingsPermissionPredicates settingsPermissionPredicates;
+  private final SettingsWsSupport settingsWsSupport;
 
   public ListDefinitionsAction(DbClient dbClient, ComponentFinder componentFinder, UserSession userSession, PropertyDefinitions propertyDefinitions,
-    SettingsPermissionPredicates settingsPermissionPredicates) {
+    SettingsWsSupport settingsWsSupport) {
     this.dbClient = dbClient;
     this.componentFinder = componentFinder;
     this.userSession = userSession;
     this.propertyDefinitions = propertyDefinitions;
-    this.settingsPermissionPredicates = settingsPermissionPredicates;
+    this.settingsWsSupport = settingsWsSupport;
   }
 
   @Override
@@ -93,7 +93,7 @@ public class ListDefinitionsAction implements SettingsWsAction {
     ListDefinitionsWsResponse.Builder wsResponse = ListDefinitionsWsResponse.newBuilder();
     propertyDefinitions.getAll().stream()
       .filter(definition -> qualifier.isPresent() ? definition.qualifiers().contains(qualifier.get()) : definition.global())
-      .filter(settingsPermissionPredicates.isDefinitionVisible(component))
+      .filter(settingsWsSupport.isDefinitionVisible(component))
       .forEach(definition -> addDefinition(definition, wsResponse));
     return wsResponse.build();
   }

server/sonar-server/src/main/java/org/sonar/server/setting/ws/ScannerSettings.java

@@ -35,7 +35,7 @@ import static org.sonar.api.CoreProperties.PERMANENT_SERVER_ID;
 import static org.sonar.api.CoreProperties.SERVER_ID;
 import static org.sonar.api.CoreProperties.SERVER_STARTTIME;
 import static org.sonar.api.PropertyType.LICENSE;
-import static org.sonar.server.setting.ws.SettingsPermissionPredicates.LICENSE_HASH_SUFFIX;
+import static org.sonar.server.setting.ws.SettingsWsSupport.LICENSE_HASH_SUFFIX;
 
 /**
  * This class returns the list of settings required on scanner side (licenses, license hashes, server ids, etc.)

server/sonar-server/src/main/java/org/sonar/server/setting/ws/SettingsWsModule.java

@@ -27,7 +27,7 @@ public class SettingsWsModule extends Module {
     add(
       SettingsWs.class,
       SetAction.class,
-      SettingsPermissionPredicates.class,
+      SettingsWsSupport.class,
       ListDefinitionsAction.class,
       ValuesAction.class,
       SettingsFinder.class,

server/sonar-server/src/main/java/org/sonar/server/setting/ws/SettingsPermissionPredicates.java → server/sonar-server/src/main/java/org/sonar/server/setting/ws/SettingsWsSupport.java

@@ -23,23 +23,28 @@ import java.util.Optional;
 import java.util.function.Predicate;
 import javax.annotation.Nullable;
 import org.sonar.api.config.PropertyDefinition;
+import org.sonar.api.server.ServerSide;
 import org.sonar.db.component.ComponentDto;
+import org.sonar.server.organization.DefaultOrganizationProvider;
 import org.sonar.server.user.UserSession;
 
 import static org.sonar.api.PropertyType.LICENSE;
 import static org.sonar.api.web.UserRole.ADMIN;
 import static org.sonar.core.permission.GlobalPermissions.SCAN_EXECUTION;
 
-public class SettingsPermissionPredicates {
+@ServerSide
+public class SettingsWsSupport {
 
   public static final String DOT_SECURED = ".secured";
   public static final String DOT_LICENSE = ".license";
   private static final String LICENSE_SUFFIX = DOT_LICENSE + DOT_SECURED;
   static final String LICENSE_HASH_SUFFIX = ".licenseHash" + DOT_SECURED;
 
+  private final DefaultOrganizationProvider defaultOrganizationProvider;
   private final UserSession userSession;
 
-  public SettingsPermissionPredicates(UserSession userSession) {
+  public SettingsWsSupport(DefaultOrganizationProvider defaultOrganizationProvider, UserSession userSession) {
+    this.defaultOrganizationProvider = defaultOrganizationProvider;
     this.userSession = userSession;
   }
 
@@ -67,7 +72,12 @@ public class SettingsPermissionPredicates {
     return key.endsWith(LICENSE_SUFFIX) || key.endsWith(LICENSE_HASH_SUFFIX) || (definition != null && definition.type() == LICENSE);
   }
 
-  private boolean hasPermission(String permission, Optional<ComponentDto> component) {
-    return userSession.hasPermission(permission) || (component.isPresent() && userSession.hasComponentPermission(permission, component.get()));
+  private boolean hasPermission(String projectOrOrgPermission, Optional<ComponentDto> component) {
+    if (userSession.hasOrganizationPermission(defaultOrganizationProvider.get().getUuid(), projectOrOrgPermission)) {
+      return true;
+    }
+    return component
+      .map(c -> userSession.hasComponentPermission(projectOrOrgPermission, c))
+      .orElse(false);
   }
 }

server/sonar-server/src/main/java/org/sonar/server/setting/ws/ValuesAction.java

@@ -65,17 +65,17 @@ public class ValuesAction implements SettingsWsAction {
   private final UserSession userSession;
   private final PropertyDefinitions propertyDefinitions;
   private final SettingsFinder settingsFinder;
-  private final SettingsPermissionPredicates settingsPermissionPredicates;
+  private final SettingsWsSupport settingsWsSupport;
   private final ScannerSettings scannerSettings;
 
   public ValuesAction(DbClient dbClient, ComponentFinder componentFinder, UserSession userSession, PropertyDefinitions propertyDefinitions, SettingsFinder settingsFinder,
-    SettingsPermissionPredicates settingsPermissionPredicates, ScannerSettings scannerSettings) {
+                      SettingsWsSupport settingsWsSupport, ScannerSettings scannerSettings) {
     this.dbClient = dbClient;
     this.componentFinder = componentFinder;
     this.userSession = userSession;
     this.propertyDefinitions = propertyDefinitions;
     this.settingsFinder = settingsFinder;
-    this.settingsPermissionPredicates = settingsPermissionPredicates;
+    this.settingsWsSupport = settingsWsSupport;
     this.scannerSettings = scannerSettings;
   }
 
@@ -154,7 +154,7 @@ public class ValuesAction implements SettingsWsAction {
     settings.addAll(settingsFinder.loadGlobalSettings(dbSession, keys));
     component.ifPresent(componentDto -> settings.addAll(settingsFinder.loadComponentSettings(dbSession, keys, componentDto).values()));
     return settings.stream()
-      .filter(settingsPermissionPredicates.isSettingVisible(component))
+      .filter(settingsWsSupport.isSettingVisible(component))
       .collect(Collectors.toList());
   }
 
@@ -272,7 +272,7 @@ public class ValuesAction implements SettingsWsAction {
       propertySets.forEach(map -> {
         Map<String, String> set = new HashMap<>();
         map.entrySet().stream()
-          .filter(entry -> settingsPermissionPredicates.isVisible(entry.getKey(), null, requestedComponent))
+          .filter(entry -> settingsWsSupport.isVisible(entry.getKey(), null, requestedComponent))
           .forEach(entry -> set.put(entry.getKey(), entry.getValue()));
         filteredPropertySets.add(set);
       });

server/sonar-server/src/test/java/org/sonar/server/setting/ws/ListDefinitionsActionTest.java

@@ -36,8 +36,11 @@ import org.sonar.db.DbClient;
 import org.sonar.db.DbTester;
 import org.sonar.db.component.ComponentDbTester;
 import org.sonar.db.component.ComponentDto;
+import org.sonar.db.organization.OrganizationDto;
 import org.sonar.server.component.ComponentFinder;
 import org.sonar.server.exceptions.ForbiddenException;
+import org.sonar.server.organization.DefaultOrganizationProvider;
+import org.sonar.server.organization.TestDefaultOrganizationProvider;
 import org.sonar.server.tester.UserSessionRule;
 import org.sonar.server.ws.TestRequest;
 import org.sonar.server.ws.WsActionTester;
@@ -81,15 +84,14 @@ public class ListDefinitionsActionTest {
   @Rule
   public DbTester db = DbTester.create(System2.INSTANCE);
 
-  DbClient dbClient = db.getDbClient();
-  ComponentDbTester componentDb = new ComponentDbTester(db);
-
-  ComponentDto project;
-
-  PropertyDefinitions propertyDefinitions = new PropertyDefinitions();
-
-  WsActionTester ws = new WsActionTester(
-    new ListDefinitionsAction(dbClient, new ComponentFinder(dbClient), userSession, propertyDefinitions, new SettingsPermissionPredicates(userSession)));
+  private DbClient dbClient = db.getDbClient();
+  private ComponentDbTester componentDb = new ComponentDbTester(db);
+  private ComponentDto project;
+  private PropertyDefinitions propertyDefinitions = new PropertyDefinitions();
+  private DefaultOrganizationProvider defaultOrganizationProvider = TestDefaultOrganizationProvider.from(db);
+  private SettingsWsSupport support = new SettingsWsSupport(defaultOrganizationProvider, userSession);
+  private WsActionTester ws = new WsActionTester(
+    new ListDefinitionsAction(dbClient, new ComponentFinder(dbClient), userSession, propertyDefinitions, support));
 
   @Before
   public void setUp() throws Exception {
@@ -98,7 +100,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_settings_definitions() {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .name("Foo")
@@ -126,7 +128,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_settings_definitions_with_minimum_fields() {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .build());
@@ -149,7 +151,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_settings_definitions_with_deprecated_key() {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .name("Foo")
@@ -167,7 +169,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_default_category() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition.builder("foo").build(), "default");
     propertyDefinitions.addComponent(PropertyDefinition.builder("foo").category("").build(), "default");
 
@@ -180,7 +182,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_single_select_list_property() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .type(PropertyType.SINGLE_SELECT_LIST)
@@ -197,7 +199,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_property_set() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .type(PropertyType.PROPERTY_SET)
@@ -228,7 +230,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_license_type_in_property_set() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .type(PropertyType.PROPERTY_SET)
@@ -243,7 +245,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_global_settings_definitions() {
-    setAuthenticatedUser();
+    logIn();
     propertyDefinitions.addComponent(PropertyDefinition.builder("foo").build());
 
     ListDefinitionsWsResponse result = executeRequest();
@@ -253,7 +255,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_project_settings_def_by_project_key() {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     propertyDefinitions.addComponent(PropertyDefinition
       .builder("foo")
       .onQualifiers(PROJECT)
@@ -266,7 +268,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_only_global_properties_when_no_component_parameter() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("global").build(),
       PropertyDefinition.builder("global-and-project").onQualifiers(PROJECT).build(),
@@ -280,7 +282,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_only_properties_available_for_component_qualifier() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("global").build(),
       PropertyDefinition.builder("global-and-project").onQualifiers(PROJECT).build(),
@@ -294,7 +296,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void does_not_return_hidden_properties() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin(db.getDefaultOrganization());
     propertyDefinitions.addComponent(PropertyDefinition.builder("foo").hidden().build());
 
     ListDefinitionsWsResponse result = executeRequest();
@@ -304,7 +306,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_license_type() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin(db.getDefaultOrganization());
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("plugin.license.secured").type(PropertyType.LICENSE).build(),
       PropertyDefinition.builder("commercial.plugin").type(PropertyType.LICENSE).build()));
@@ -330,7 +332,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_license_settings_when_authenticated_but_not_admin() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -344,7 +346,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_secured_settings_when_not_authenticated_but_with_scan_permission() throws Exception {
-    userSession.setGlobalPermissions(SCAN_EXECUTION);
+    userSession.anonymous().addOrganizationPermission(db.getDefaultOrganization(), SCAN_EXECUTION);
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -358,7 +360,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_secured_and_license_settings_when_system_admin() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin(db.getDefaultOrganization());
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -371,7 +373,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void return_secured_and_license_settings_when_project_admin() throws Exception {
-    setUserAsProjectAdmin();
+    logInAsProjectAdmin();
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("foo").onQualifiers(PROJECT).build(),
       PropertyDefinition.builder("secret.secured").onQualifiers(PROJECT).build(),
@@ -404,7 +406,7 @@ public class ListDefinitionsActionTest {
 
   @Test
   public void test_example_json_response() {
-    setUserAsSystemAdmin();
+    logInAsProjectAdmin();
     propertyDefinitions.addComponents(asList(
       PropertyDefinition.builder("sonar.string")
         .name("String")
@@ -470,20 +472,20 @@ public class ListDefinitionsActionTest {
     }
   }
 
-  private void setAuthenticatedUser() {
-    userSession.logIn("user");
+  private void logIn() {
+    userSession.logIn();
   }
 
-  private void setUserWithBrowsePermissionOnProject() {
-    userSession.logIn("user").addProjectUuidPermissions(USER, project.uuid());
+  private void logInAsProjectUser() {
+    userSession.logIn().addProjectUuidPermissions(USER, project.uuid());
   }
 
-  private void setUserAsSystemAdmin() {
-    userSession.logIn("admin").setGlobalPermissions(SYSTEM_ADMIN);
+  private void logInAsAdmin(OrganizationDto org) {
+    userSession.logIn().addOrganizationPermission(org, SYSTEM_ADMIN);
   }
 
-  private void setUserAsProjectAdmin() {
-    userSession.logIn("project-admin")
+  private void logInAsProjectAdmin() {
+    userSession.logIn()
       .addProjectUuidPermissions(ADMIN, project.uuid())
       .addProjectUuidPermissions(USER, project.uuid());
   }

server/sonar-server/src/test/java/org/sonar/server/setting/ws/ValuesActionTest.java

@@ -45,6 +45,8 @@ import org.sonar.db.organization.OrganizationDto;
 import org.sonar.db.property.PropertyDbTester;
 import org.sonar.server.component.ComponentFinder;
 import org.sonar.server.exceptions.ForbiddenException;
+import org.sonar.server.organization.DefaultOrganizationProvider;
+import org.sonar.server.organization.TestDefaultOrganizationProvider;
 import org.sonar.server.tester.UserSessionRule;
 import org.sonar.server.ws.TestRequest;
 import org.sonar.server.ws.WsActionTester;
@@ -94,11 +96,12 @@ public class ValuesActionTest {
   private SettingsFinder settingsFinder = new SettingsFinder(dbClient, definitions);
   private PluginRepository repository = mock(PluginRepository.class);
   private ScannerSettings scannerSettings = new ScannerSettings(definitions, repository);
-
+  private DefaultOrganizationProvider defaultOrganizationProvider = TestDefaultOrganizationProvider.from(db);
+  private SettingsWsSupport support = new SettingsWsSupport(defaultOrganizationProvider, userSession);
   private ComponentDto project;
 
   private WsActionTester ws = new WsActionTester(
-    new ValuesAction(dbClient, new ComponentFinder(dbClient), userSession, definitions, settingsFinder, new SettingsPermissionPredicates(userSession), scannerSettings));
+    new ValuesAction(dbClient, new ComponentFinder(dbClient), userSession, definitions, settingsFinder, support, scannerSettings));
 
   @Before
   public void setUp() throws Exception {
@@ -112,7 +115,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_simple_value() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .build());
@@ -129,7 +132,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_multi_values() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     // Property never defined, default value is returned
     definitions.addComponent(PropertyDefinition.builder("default")
       .multiValues(true)
@@ -155,7 +158,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_multi_value_with_coma() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition.builder("global").multiValues(true).build());
     propertyDb.insertProperties(newGlobalPropertyDto().setKey("global").setValue("three,four%2Cfive"));
 
@@ -169,7 +172,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_property_set() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .type(PropertyType.PROPERTY_SET)
@@ -189,7 +192,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_property_set_for_component() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .type(PropertyType.PROPERTY_SET)
@@ -210,7 +213,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_default_values() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .defaultValue("default")
@@ -224,7 +227,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_global_values() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition.builder("property").defaultValue("default").build());
     propertyDb.insertProperties(
       // The property is overriding default value
@@ -238,7 +241,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_project_values() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     definitions.addComponent(
       PropertyDefinition.builder("property").defaultValue("default").onQualifiers(PROJECT).build());
     propertyDb.insertProperties(
@@ -254,7 +257,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_settings_defined_only_at_global_level_when_loading_project_settings() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     definitions.addComponents(asList(
       PropertyDefinition.builder("global").build(),
       PropertyDefinition.builder("global.default").defaultValue("default").build(),
@@ -271,7 +274,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_is_inherited_to_true_when_property_is_defined_only_at_global_level() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     definitions.addComponent(PropertyDefinition.builder("property").defaultValue("default").onQualifiers(PROJECT).build());
     // The property is not defined on project
     propertyDb.insertProperties(newGlobalPropertyDto().setKey("property").setValue("one"));
@@ -284,7 +287,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_values_even_if_no_property_definition() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     propertyDb.insertProperties(newGlobalPropertyDto().setKey("globalPropertyWithoutDefinition").setValue("value"));
 
     ValuesWsResponse result = executeRequestForGlobalProperties("globalPropertyWithoutDefinition");
@@ -297,7 +300,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_empty_when_property_def_exists_but_no_value() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .build());
@@ -309,7 +312,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_nothing_when_unknown_keys() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .defaultValue("default")
@@ -323,7 +326,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_module_values() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     definitions.addComponent(PropertyDefinition.builder("property").defaultValue("default").onQualifiers(PROJECT, MODULE).build());
     propertyDb.insertProperties(
@@ -339,7 +342,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_inherited_values_on_module() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     definitions.addComponents(asList(
       PropertyDefinition.builder("defaultProperty").defaultValue("default").onQualifiers(PROJECT, MODULE).build(),
@@ -362,7 +365,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_inherited_values_on_global_setting() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponents(asList(
       PropertyDefinition.builder("defaultProperty").defaultValue("default").build(),
       PropertyDefinition.builder("globalProperty").build()));
@@ -378,7 +381,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_parent_value() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     ComponentDto subModule = componentDb.insertComponent(newModuleDto(module));
     definitions.addComponents(asList(
@@ -396,7 +399,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_parent_values() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     ComponentDto subModule = componentDb.insertComponent(newModuleDto(module));
     definitions.addComponents(asList(
@@ -414,7 +417,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_parent_field_values() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     ComponentDto subModule = componentDb.insertComponent(newModuleDto(module));
     definitions.addComponent(PropertyDefinition
@@ -437,7 +440,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_no_parent_value() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     ComponentDto subModule = componentDb.insertComponent(newModuleDto(module));
     definitions.addComponents(asList(
@@ -462,7 +465,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_parent_value_when_no_definition() throws Exception {
-    setUserWithBrowsePermissionOnProject();
+    logInAsProjectUser();
     ComponentDto module = componentDb.insertComponent(newModuleDto(project));
     propertyDb.insertProperties(
       newGlobalPropertyDto().setKey("foo").setValue("global"),
@@ -475,7 +478,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_value_of_deprecated_key() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .deprecatedKey("deprecated")
@@ -527,7 +530,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_license_with_hash_settings_when_authenticated_but_not_admin() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -548,7 +551,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_global_secured_settings_when_not_authenticated_but_with_scan_permission() throws Exception {
-    userSession.setGlobalPermissions(SCAN_EXECUTION);
+    userSession.anonymous().addOrganizationPermission(db.getDefaultOrganization(), SCAN_EXECUTION);
     definitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -606,7 +609,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_secured_and_license_settings_when_system_admin() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin();
     definitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -624,7 +627,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_secured_and_license_settings_when_project_admin() throws Exception {
-    setUserAsProjectAdmin();
+    logInAsProjectAdmin();
     definitions.addComponents(asList(
       PropertyDefinition.builder("foo").onQualifiers(PROJECT).build(),
       PropertyDefinition.builder("global.secret.secured").build(),
@@ -645,7 +648,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_secured_and_license_settings_even_if_not_defined_when_project_admin() throws Exception {
-    setUserAsProjectAdmin();
+    logInAsProjectAdmin();
     propertyDb.insertProperties(newComponentPropertyDto(project).setKey("not-defined.secured").setValue("123"));
 
     ValuesWsResponse result = executeRequestForProjectProperties("not-defined.secured");
@@ -655,7 +658,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_secured_and_license_settings_in_property_set_when_system_admin() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .type(PropertyType.PROPERTY_SET)
@@ -673,7 +676,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_global_settings_from_definitions_when_no_component_and_no_keys() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin();
     definitions.addComponents(asList(
       PropertyDefinition.builder("foo").build(),
       PropertyDefinition.builder("secret.secured").build(),
@@ -690,7 +693,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_project_settings_from_definitions_when_component_and_no_keys() throws Exception {
-    setUserAsProjectAdmin();
+    logInAsProjectAdmin();
     definitions.addComponents(asList(
       PropertyDefinition.builder("foo").onQualifiers(PROJECT).build(),
       PropertyDefinition.builder("secret.secured").onQualifiers(PROJECT).build(),
@@ -707,7 +710,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_additional_settings_specific_for_scanner_when_no_keys() throws Exception {
-    setUserAsSystemAdmin();
+    logInAsAdmin();
     definitions.addComponent(PropertyDefinition.builder("plugin.license.secured").type(LICENSE).build());
     propertyDb.insertProperties(
       newGlobalPropertyDto().setKey("sonar.server_id").setValue("12345"),
@@ -724,7 +727,7 @@ public class ValuesActionTest {
 
   @Test
   public void return_simple_value_with_non_ascii_characters() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .build());
@@ -747,7 +750,7 @@ public class ValuesActionTest {
 
   @Test
   public void fail_when_deprecated_key_and_new_key_are_used() throws Exception {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("foo")
       .deprecatedKey("deprecated")
@@ -762,7 +765,7 @@ public class ValuesActionTest {
 
   @Test
   public void test_example_json_response() {
-    setAuthenticatedUser();
+    logIn();
     definitions.addComponent(PropertyDefinition
       .builder("sonar.test.jira")
       .defaultValue("abc")
@@ -827,20 +830,20 @@ public class ValuesActionTest {
     }
   }
 
-  private void setAuthenticatedUser() {
-    userSession.logIn("user");
+  private void logIn() {
+    userSession.logIn();
   }
 
-  private void setUserWithBrowsePermissionOnProject() {
-    userSession.logIn("user").addProjectUuidPermissions(USER, project.uuid());
+  private void logInAsProjectUser() {
+    userSession.logIn().addProjectUuidPermissions(USER, project.uuid());
   }
 
-  private void setUserAsSystemAdmin() {
-    userSession.logIn("admin").setGlobalPermissions(SYSTEM_ADMIN);
+  private void logInAsAdmin() {
+    userSession.logIn().addOrganizationPermission(db.getDefaultOrganization(), SYSTEM_ADMIN);
   }
 
-  private void setUserAsProjectAdmin() {
-    userSession.logIn("project-admin")
+  private void logInAsProjectAdmin() {
+    userSession.logIn()
       .addProjectUuidPermissions(ADMIN, project.uuid())
       .addProjectUuidPermissions(USER, project.uuid());
   }